Securealy
Check · Performance · low · passive

Home page under 2 MB

Total transfer for the home page is under 2 MB.

Severity
low
Tier
Passive: runs on any URL
Category
Performance
Fix
Summary below; full runbook in the Fix Kit, Module 01: Ship it
Id
page-weight

What this means

Passing means the home page and the first-party assets it loads total under 2 MB of transfer. Failing means they weigh more than that. Weight is the bytes sent over the wire, so a compressed stylesheet counts at its compressed size.

How we test it

We fetch the home page, parse it, and fetch each first-party script, stylesheet, font and image it references, adding up the transferred bytes. Under 2 MB passes. Over 2 MB fails. Third-party assets are not fetched or counted.

Why it matters

Weight is the mobile experience. On a phone over mobile data, 2 MB is seconds of waiting before the page settles, and the kit's by-hand check is exactly that: open the site on real mobile data and tap through the nav. The usual cause is one image, which is why the next check isolates it; the second is a font or script bundle that ships everything the framework knows how to do.

The fix

Find the largest assets with curl -sI ASSET_URL | grep -i content-length on each one the page loads, then shrink them in order: images resized to the size they are displayed at and converted to WebP where the build can produce it, loading="lazy" on everything below the fold, fonts self-hosted or system, and scripts not needed on first view deferred. Confirm by re-running the Securealy check, or by adding curl -s -o /dev/null -w '%{size_download}\n' URL across the page and its first-party assets, expected a total under 2097152 bytes. The full runbook is in the Fix Kit, Module 01.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything. This is a verification pass.
Run: curl -s -o /dev/null -w '%{size_download}\n' https://YOUR_DOMAIN/ and show me the HTML size in bytes.
Run: curl -s https://YOUR_DOMAIN/ | grep -oE '(src|href)="[^"]+\.(js|css|woff2?|png|jpe?g|webp|svg|gif)[^"]*"' | sort -u and show me the asset list.
For each first-party asset, run: curl -sI https://YOUR_DOMAIN/THAT_PATH | grep -i content-length and show me the size.
Add the sizes up and tell me the total, and list the five largest assets with their sizes and the file that references each.
List what it would take to bring the total under 2 MB, largest first, and stop there.
Tell me the total again as a single number. Expected on a passing site: under 2097152.

Next

Grade your own URL

Every grade lists this check with its evidence for your site. Two free grades a day.